ClearanceKit

ClearanceKit uses Apple's Endpoint Security framework to sit between processes and the paths you mark as protected, such as SSH keys, credentials or browser profiles. Accesses without an allow rule are denied and listed in the app, where you can turn them into policy. Rules are bound to a developer's signing identity rather than a file path, and jail rules can confine a process to specific folders.

It targets developers worried about compromised packages running with full user permissions. Setup requires approving a system extension and granting Full Disk Access, and overly strict rules can break tools you rely on, so build policy gradually.